Coldcard users are being warned of a new wave of coordinated thefts targeting their Bitcoin hardware wallets, with Galaxy research head Alex Thorn identifying 709 potential victim addresses and 448.7 Bitcoin moved in recent transactions. The activity follows a previously undetected firmware flaw in Coldcard devices, which has caused affected wallets to generate seeds with less entropy, leading to estimated losses of over $90 million.
The theft pattern, reportedly linked to the vulnerability, has seen transactions averaging 13.8 sweeps per block—45 times the pre-incident control window rate—according to Thorn’s analysis. The researcher described the affected addresses as “LIKELY Coldcard victims,” citing their alignment with the “shape of coldcard vulnerable utxos” and the elevated transaction pattern.
Thorn’s findings build on a prior estimate of $70 million in losses, though the latest figure remains subject to revision. The firm has not yet confirmed the extent of the firmware flaw or provided specific guidance for users. Affected individuals are advised to monitor their wallets for unusual activity, as the breach underscores growing risks in hardware wallet security.
Written by Daniel Brooks
Security Desk
